MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71c0a6fb3c31d1fa82fb99ddda7811810d9bf6306ce7e3377547035fe6b512f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 71c0a6fb3c31d1fa82fb99ddda7811810d9bf6306ce7e3377547035fe6b512f2
SHA3-384 hash: 1cb0d749f5227022b58b894f9cd25ea6736cfd65a8e4146d841791d214b48c959708f3ac8a4efddce0bdf84f1b96ac99
SHA1 hash: 0e983ef5678dd5ce3b3ced2966ff9be1c7a332be
MD5 hash: 4e2604bc3abfaeba1b0cffacaafc9fd5
humanhash: skylark-avocado-avocado-texas
File name:4e2604bc3abfaeba1b0cffacaafc9fd5.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:194'560 bytes
First seen:2021-07-14 15:20:20 UTC
Last seen:2021-07-14 16:11:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f9c1cf1b2cfb3ee96a94f56e9a89c09a (6 x Smoke Loader)
ssdeep 3072:XBNmhnmLGgLnM16WAjC9BTdlwt2OVw1Cm5Bzck4H0:xemLGgLnMBJ9BRutBw1/K
Threatray 550 similar samples on MalwareBazaar
TLSH T17414AE2132E3D431D6E346301434D7A12A7FBB326637864F376426EE5E312D19AB635B
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
2
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4e2604bc3abfaeba1b0cffacaafc9fd5.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-14 15:42:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4a63f3cf-2120-4964-98f1-69643fe6aa31

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DLInjector01
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171733/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.31462.19949.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bc4f05e5-8e18-432b-95d6-a3e24ae71eec
Result
Threat name:
Djvu Raccoon RedLine SmokeLoader Tofsee
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/816446
Signature
.NET source code contains very large array initializations
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Contains functionality to steal Internet Explorer form passwords
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
DLL reload attack detected
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Renames NTDLL to bypass HIPS
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to resolve many domain names, but no domain seems valid
Tries to steal Mail credentials (via file access)
Yara detected Djvu Ransomware
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 448863 Sample: 2aJ9QdIdFE.exe Startdate: 14/07/2021 Architecture: WINDOWS Score: 100 81 fastpool.xyz 2->81 83 api.ip.sb 2->83 85 6 other IPs or domains 2->85 129 Multi AV Scanner detection for domain / URL 2->129 131 Found malware configuration 2->131 133 Antivirus detection for URL or domain 2->133 135 14 other signatures 2->135 10 2aJ9QdIdFE.exe 2->10         started        13 irjihjr 2->13         started        15 svchost.exe 2->15         started        18 egjihjr 2->18         started        signatures3 process4 dnsIp5 147 DLL reload attack detected 10->147 149 Detected unpacking (changes PE section rights) 10->149 20 2aJ9QdIdFE.exe 1 10->20         started        151 Contains functionality to inject code into remote processes 13->151 153 Injects a PE file into a foreign processes 13->153 23 irjihjr 1 13->23         started        101 127.0.0.1 unknown unknown 15->101 signatures6 process7 file8 137 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 20->137 139 Renames NTDLL to bypass HIPS 20->139 141 Maps a DLL or memory area into another process 20->141 26 explorer.exe 17 20->26 injected 53 C:\Users\user\AppData\Local\Temp\AE30.tmp, PE32 23->53 dropped 143 Checks if the current machine is a virtual machine (disk enumeration) 23->143 145 Creates a thread in another existing process (thread injection) 23->145 signatures9 process10 dnsIp11 93 999080321yomtest251-service10020125999080321.ru 26->93 95 999080321yirtest231-service10020125999080321.ru 26->95 97 88 other IPs or domains 26->97 55 C:\Users\user\AppData\Roaming\irjihjr, PE32 26->55 dropped 57 C:\Users\user\AppData\Local\Temp\F5A2.exe, PE32 26->57 dropped 59 C:\Users\user\AppData\Local\Temp\DAAA.exe, PE32+ 26->59 dropped 61 6 other files (4 malicious) 26->61 dropped 163 System process connects to network (likely due to code injection or exploit) 26->163 165 Benign windows process drops PE files 26->165 167 Performs DNS queries to domains with low reputation 26->167 171 2 other signatures 26->171 31 DAAA.exe 2 5 26->31         started        35 F5A2.exe 80 26->35         started        38 C2CB.exe 1 26->38         started        40 18 other processes 26->40 file12 169 Tries to resolve many domain names, but no domain seems valid 95->169 signatures13 process14 dnsIp15 65 C:\Users\user\AppData\...\MicrosoftApi.exe, PE32+ 31->65 dropped 67 C:\Users\user\...\ICSharpCode.SharpZipLib.dll, PE32 31->67 dropped 103 Detected unpacking (changes PE section rights) 31->103 105 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 31->105 107 Query firmware table information (likely to detect VMs) 31->107 125 2 other signatures 31->125 42 MicrosoftApi.exe 31->42         started        87 telete.in 195.201.225.248, 443, 49724 HETZNER-ASDE Germany 35->87 89 34.89.184.90, 49725, 80 GOOGLEUS United States 35->89 69 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 35->69 dropped 71 C:\Users\user\AppData\...\vcruntime140.dll, PE32 35->71 dropped 73 C:\Users\user\AppData\...\ucrtbase.dll, PE32 35->73 dropped 79 56 other files (none is malicious) 35->79 dropped 109 Detected unpacking (overwrites its own PE header) 35->109 111 Tries to steal Mail credentials (via file access) 35->111 113 Contains functionality to steal Internet Explorer form passwords 35->113 75 C:\Users\user\AppData\Local\Temp\1105.tmp, PE32 38->75 dropped 115 DLL reload attack detected 38->115 127 5 other signatures 38->127 91 999080321newfolder1002-01462599908032135.site 40->91 77 C:\Users\user\AppData\Local\...\coaxgen.exe, PE32 40->77 dropped 117 System process connects to network (likely due to code injection or exploit) 40->117 119 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 40->119 121 Tries to harvest and steal browser information (history, passwords, etc) 40->121 123 Injects a PE file into a foreign processes 40->123 45 1575.exe 40->45         started        49 conhost.exe 40->49         started        51 C689.exe 40->51         started        file16 signatures17 process18 dnsIp19 155 Detected unpacking (changes PE section rights) 42->155 157 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 42->157 159 Query firmware table information (likely to detect VMs) 42->159 161 3 other signatures 42->161 99 api.2ip.ua 77.123.139.190, 443, 49747, 49748 VOLIA-ASUA Ukraine 45->99 63 C:\Users\user\AppData\Local\...\1575.exe, PE32 45->63 dropped file20 signatures21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/71c0a6fb3c31d1fa82fb99ddda7811810d9bf6306ce7e3377547035fe6b512f2/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-07-14 15:21:10 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ohakn6z4ghi7vax3tho5u6arqegzx5rqntt6gn3vi4bv7zvvclza._file
Verdict:
suspicious
Similar samples:
13cb7156b54db1b9d8ff5c405e9324899cd7ef801bdff04b1155dd9b104f7cdc
Smoke Loader
1b7769f85c3874451b85f83ab1ddc08b0d07fe76f354e0c7b397308894095673
Smoke Loader
451ce50988cfa9b6a5c51cc0cfab60a40694f06f83b31ca168225256e223e5a7
Smoke Loader
4a0ecbcf9b54ed1c9654eb9ee214a797f48c980c6d03a261f62fa9671a2733d6
Smoke Loader
63761462358e1f880dafe51b3de8036f10bc60354b981cddc8075aed22e1251d
Smoke Loader
653d4491de7461361a379e7ed09e172c06d669d25fed55f134a1b278827f2efe
Smoke Loader
8b7e447356ade4824db0565f713751a6c0b37cc560269ced9cc6176e1d1fdd24
Smoke Loader
90c0cf976bc9377697fb31e8ca6f21aee0168cc5471a8ac33ece631ee346afa9
Smoke Loader
948bae9510601455f2ba50d694a6561bf2e85071b86161a0186672616ae17a77
Smoke Loader
ae7ae9ea7fd0100b620704d462083caaedda2c5c5618ceeca54c1d7673b6be4a
Smoke Loader
+ 540 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader family:tofsee family:vidar family:xmrig botnet:517 botnet:824 botnet:btccach backdoor discovery evasion infostealer miner persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/210714-ygf4ctznx6/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Modifies file permissions
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Themida packer
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar Stealer
XMRig Miner Payload
Raccoon
RedLine
RedLine Payload
SmokeLoader
Tofsee
Vidar
Windows security bypass
xmrig
Malware Config
C2 Extraction:
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/
https://olegf9844.tumblr.com/
185.53.46.82:3214
Unpacked files
SH256 hash:
40f733e06f7bcb4bd915fbd0c3fbb05ee571094c0999c0104b661e9de72b8ec2
MD5 hash:
cda6ff3c17a09d22225df0ae90c705dc
SHA1 hash:
d822189153fb12866cb798cbfbe198a7b40e62ca
Link:
https://www.unpac.me/results/a939d38c-dd2b-4155-9842-dbf09d7dab8c/
SH256 hash:
71c0a6fb3c31d1fa82fb99ddda7811810d9bf6306ce7e3377547035fe6b512f2
MD5 hash:
4e2604bc3abfaeba1b0cffacaafc9fd5
SHA1 hash:
0e983ef5678dd5ce3b3ced2966ff9be1c7a332be
Link:
https://www.unpac.me/results/a939d38c-dd2b-4155-9842-dbf09d7dab8c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/71c0a6fb3c31d1fa82fb99ddda7811810d9bf6306ce7e3377547035fe6b512f2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 71c0a6fb3c31d1fa82fb99ddda7811810d9bf6306ce7e3377547035fe6b512f2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1453973/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/171733/

Comments